{
  "enabled": true,
  "name": "Pre-Commit Security Scan",
  "description": "Before any git commit shell command runs, scan staged changes for exposed secrets, API keys, hardcoded IPs/passwords, and verify .gitignore covers credentials. Flags public repo commits.",
  "version": "1",
  "when": {
    "type": "preToolUse",
    "toolTypes": [
      "shell"
    ]
  },
  "then": {
    "type": "askAgent",
    "prompt": "A shell command is about to run. If it is a `git commit` or `git push`, perform a security review BEFORE allowing it: 1) Scan staged files for exposed secrets, API keys, tokens, hardcoded passwords, and hardcoded IP addresses. 2) Verify .gitignore includes credential files (.env, .secrets/, *.key, *.pem). 3) If the remote is a public repository, warn the user and suggest a private server. Report any findings by key name only, never echo secret values. If the command is not a git commit/push, take no action."
  }
}